IOC Report
ZjH6H6xqo7.exe

loading gif

Files

File Path
Type
Category
Malicious
ZjH6H6xqo7.exe
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
initial sample
 malicious
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\ZjH6H6xqo7.exe.log
CSV text
dropped
 malicious
C:\Users\user\AppData\Local\Temp\up5gphgh\up5gphgh.0.cs
Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
dropped
 malicious
C:\Users\user\AppData\Local\Temp\up5gphgh\up5gphgh.cmdline
Unicode text, UTF-8 (with BOM) text, with no line terminators
dropped
 malicious
C:\Users\user\AppData\Local\Temp\up5gphgh\up5gphgh.dll
PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Temp\RES6781.tmp
Intel 80386 COFF object file, not stripped, 3 sections, symbol offset=0x492, 9 symbols, created Sun Nov 24 08:41:24 2024, 1st section name ".debug$S"
dropped
C:\Users\user\AppData\Local\Temp\up5gphgh\CSCE347F25DAC914FE0BD5774A121A2513C.TMP
MSVC .res
dropped
C:\Users\user\AppData\Local\Temp\up5gphgh\up5gphgh.out
Unicode text, UTF-8 (with BOM) text, with CRLF, CR line terminators
modified

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\ZjH6H6xqo7.exe
"C:\Users\user\Desktop\ZjH6H6xqo7.exe"
 malicious
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\up5gphgh\up5gphgh.cmdline"
 malicious
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\RegAsm.exe"
 malicious
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES6781.tmp" "c:\Users\user\AppData\Local\Temp\up5gphgh\CSCE347F25DAC914FE0BD5774A121A2513C.TMP"

URLs

Name
IP
Malicious
https://sector-essay.cyou/api
104.21.47.136
 malicious
https://sector-essay.cyou/5
unknown
https://sector-essay.cyou/apij
unknown
http://147.45.44.131/infopage/tvh53.exe
147.45.44.131
thicktoys.sbs
http://147.45.44.131/infopage/tvh53.exeP
unknown
300snails.sbs
https://sector-essay.cyou/apiO
unknown
faintbl0w.sbs
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
unknown
https://sector-essay.cyou/apiC
unknown
3xc1aimbl0w.sbs
https://sector-essay.cyou/
unknown
http://147.45.44.131
unknown
https://sector-essay.cyou:443/apiMicrosoft
unknown
https://sector-essay.cyou/apie
unknown
https://sector-essay.cyou:443/api
unknown
There are 7 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
sector-essay.cyou
104.21.47.136
 malicious

IPs

IP
Domain
Country
Malicious
104.21.47.136
sector-essay.cyou
United States
malicious
147.45.44.131
unknown
Russian Federation

Registry

Path
Value
Malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\ZjH6H6xqo7_RASAPI32
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\ZjH6H6xqo7_RASAPI32
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\ZjH6H6xqo7_RASAPI32
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\ZjH6H6xqo7_RASAPI32
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\ZjH6H6xqo7_RASAPI32
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\ZjH6H6xqo7_RASAPI32
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\ZjH6H6xqo7_RASAPI32
FileDirectory
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\ZjH6H6xqo7_RASMANCS
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\ZjH6H6xqo7_RASMANCS
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\ZjH6H6xqo7_RASMANCS
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\ZjH6H6xqo7_RASMANCS
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\ZjH6H6xqo7_RASMANCS
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\ZjH6H6xqo7_RASMANCS
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\ZjH6H6xqo7_RASMANCS
FileDirectory
There are 5 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
400000
remote allocation
page execute and read and write
 malicious
5702000
heap
page read and write
1070000
heap
page read and write
5BAE000
stack
page read and write
1551000
heap
page read and write
1520000
heap
page read and write
105E000
stack
page read and write
5727000
heap
page read and write
101E000
stack
page read and write
5CAF000
direct allocation
page read and write
2F10000
heap
page execute and read and write
501D000
stack
page read and write
1580000
trusted library allocation
page read and write
2FC4000
trusted library allocation
page read and write
1470000
heap
page read and write
5C20000
direct allocation
page read and write
F90000
heap
page read and write
582E000
stack
page read and write
5719000
heap
page read and write
5735000
heap
page read and write
3A18000
trusted library allocation
page read and write
2F98000
trusted library allocation
page read and write
139D000
stack
page read and write
BAE000
stack
page read and write
5702000
heap
page read and write
1407000
trusted library allocation
page execute and read and write
353D000
stack
page read and write
118E000
heap
page read and write
137E000
stack
page read and write
2FA0000
trusted library allocation
page read and write
FEE000
stack
page read and write
55C0000
heap
page read and write
367F000
stack
page read and write
592E000
stack
page read and write
456000
remote allocation
page execute and read and write
5CA0000
direct allocation
page read and write
5C00000
direct allocation
page read and write
55D0000
heap
page read and write
56F6000
heap
page read and write
53F9000
stack
page read and write
13C5000
heap
page read and write
1420000
trusted library allocation
page read and write
5520000
heap
page execute and read and write
551E000
stack
page read and write
11C2000
heap
page read and write
5CCA000
direct allocation
page read and write
13DD000
trusted library allocation
page execute and read and write
3985000
trusted library allocation
page read and write
15E9000
heap
page read and write
2F21000
trusted library allocation
page read and write
3988000
trusted library allocation
page read and write
122C000
heap
page read and write
15D3000
heap
page read and write
B4D000
stack
page read and write
5D10000
heap
page read and write
2F0E000
stack
page read and write
15F0000
heap
page read and write
13F7000
trusted library allocation
page execute and read and write
14DE000
stack
page read and write
3870000
heap
page read and write
5CE0000
direct allocation
page read and write
5719000
heap
page read and write
5672000
direct allocation
page read and write
1560000
heap
page read and write
AEE000
unkown
page readonly
152A000
heap
page read and write
5C70000
heap
page read and write
5724000
heap
page read and write
15F6000
heap
page read and write
161C000
heap
page read and write
EF9000
stack
page read and write
2F86000
trusted library allocation
page read and write
5630000
direct allocation
page read and write
5702000
heap
page read and write
5460000
heap
page read and write
5CAF000
direct allocation
page read and write
171F000
stack
page read and write
140B000
trusted library allocation
page execute and read and write
562E000
stack
page read and write
56DE000
heap
page read and write
5BEE000
stack
page read and write
5735000
heap
page read and write
2E8E000
stack
page read and write
122F000
heap
page read and write
54DD000
stack
page read and write
5710000
heap
page read and write
1545000
heap
page read and write
5732000
heap
page read and write
B00000
heap
page read and write
3F21000
trusted library allocation
page read and write
13FA000
trusted library allocation
page execute and read and write
5690000
direct allocation
page read and write
37FE000
stack
page read and write
133E000
stack
page read and write
1060000
heap
page read and write
557E000
stack
page read and write
F80000
heap
page read and write
AE0000
unkown
page readonly
13C0000
trusted library allocation
page read and write
13F0000
trusted library allocation
page read and write
1217000
heap
page read and write
5CF0000
trusted library section
page read and write
5670000
direct allocation
page read and write
5CEF000
stack
page read and write
37BE000
stack
page read and write
55BE000
stack
page read and write
13D3000
trusted library allocation
page execute and read and write
5702000
heap
page read and write
56F6000
heap
page read and write
160F000
heap
page read and write
158A000
heap
page read and write
13D4000
trusted library allocation
page read and write
36BE000
stack
page read and write
2F75000
trusted library allocation
page read and write
5C4F000
direct allocation
page read and write
3F89000
trusted library allocation
page read and write
155D000
stack
page read and write
13C0000
heap
page read and write
5C4F000
direct allocation
page read and write
56C8000
heap
page read and write
2F78000
trusted library allocation
page read and write
5681000
direct allocation
page read and write
15C0000
trusted library allocation
page read and write
4FFC000
stack
page read and write
1750000
heap
page read and write
1740000
trusted library allocation
page read and write
56E2000
heap
page read and write
573A000
heap
page read and write
5A6E000
stack
page read and write
B8C000
stack
page read and write
5732000
heap
page read and write
BF0000
heap
page read and write
1180000
heap
page read and write
56E5000
heap
page read and write
3F29000
trusted library allocation
page read and write
571F000
heap
page read and write
1067000
heap
page read and write
56DD000
heap
page read and write
157C000
heap
page read and write
1075000
heap
page read and write
39DC000
trusted library allocation
page read and write
99D000
stack
page read and write
572D000
heap
page read and write
1756000
heap
page read and write
2F83000
trusted library allocation
page read and write
1340000
heap
page read and write
5735000
heap
page read and write
570E000
heap
page read and write
397F000
stack
page read and write
55C5000
heap
page read and write
1609000
heap
page read and write
135F000
stack
page read and write
2F7D000
trusted library allocation
page read and write
13E0000
trusted library allocation
page read and write
357E000
stack
page read and write
5727000
heap
page read and write
1402000
trusted library allocation
page read and write
125E000
stack
page read and write
12FB000
stack
page read and write
56E4000
heap
page read and write
BF0000
heap
page read and write
3A80000
heap
page read and write
FD0000
heap
page read and write
2ECD000
stack
page read and write
56FD000
heap
page read and write
118A000
heap
page read and write
343D000
stack
page read and write
56C0000
heap
page read and write
5725000
heap
page read and write
56F2000
heap
page read and write
F0B000
stack
page read and write
56FA000
heap
page read and write
5C40000
direct allocation
page read and write
5735000
heap
page read and write
5BE0000
direct allocation
page read and write
117E000
stack
page read and write
56E1000
heap
page read and write
155A000
heap
page read and write
1570000
trusted library allocation
page execute and read and write
5739000
heap
page read and write
564D000
direct allocation
page read and write
2F8B000
trusted library allocation
page read and write
596E000
stack
page read and write
15E2000
heap
page read and write
5C80000
direct allocation
page read and write
15E0000
heap
page read and write
AE2000
unkown
page readonly
A9C000
stack
page read and write
5AAE000
stack
page read and write
5BC0000
heap
page read and write
2FFF000
stack
page read and write
3980000
trusted library allocation
page read and write
1380000
heap
page read and write
39BC000
trusted library allocation
page read and write
5BBF000
stack
page read and write
5722000
heap
page read and write
1400000
trusted library allocation
page read and write
5676000
direct allocation
page read and write
572F000
stack
page read and write
1570000
heap
page read and write
146E000
stack
page read and write
5CC0000
direct allocation
page read and write
56F7000
heap
page read and write
F70000
heap
page read and write
11B5000
heap
page read and write
59BF000
stack
page read and write
572C000
heap
page read and write
B50000
heap
page read and write
There are 198 hidden memdumps, click here to show them.